CVE-2026-84964: high-severity vulnerability in MongoDB C Driver
Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.2epss 0.3%
A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated party acting as the trusted endpoint may cause the connecting client application to terminate unexpectedly.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
MongoDB · C DriverRelated CVEs — MongoDB C Driver
In the same product, most dangerous first.
CVE-2026-96746HIGHHeap buffer overflow via mid-scan command list growth in client topology monitoringEPSS 0.4%CVE-2026-84963MEDIUMSilent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parserEPSS 0.3%CVE-2026-84969MEDIUMHeap overflow via truncated base64 encoding of binary fields in length-limited JSON outputEPSS 0.3%CVE-2026-81524MEDIUMCross-tenant database retargeting via dot/NUL injection in namespace strings in the C DriverEPSS 0.3%CVE-2026-88036MEDIUMGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C DriverEPSS 0.3%CVE-2026-106428MEDIUMOut-of-bounds read in SCRAM response parsing in MongoDB C DriverEPSS 0.2%